我得到以下代碼：<?php// If user access item through linkif(isset($_POST["v"])) { require "connect.php"; $v = $_POST['v']; $sql = "SELECT * FROM videos WHERE videoID=?;"; $stmt = mysqli_stmt_init($conn); if (!mysqli_stmt_prepare($stmt, $sql)) { echo'Sql Error'; exit(); } else { mysqli_stmt_bind_param($stmt, "i", $v); mysqli_stmt_execute($stmt); $result = mysqli_stmt_get_result($stmt); if (($row = mysqli_fetch_assoc($result)) && !preg_match("/[a-zA-Z]/", $v)) { ?> <div class="img" style="background-image: url('<?php echo $row['link']; ?>');"></div> <center><h1>Title <?php echo $row['Title']; ?> exists</h1></center> <?php exit(); } else { ?> <center><h1>Title does not exist</h1></center> <?php exit(); } }}// If user clicks on itemif(isset($_POST["itemid"])) { require "connect.php"; $itemid = $_POST['itemid']; $sql = "SELECT * FROM videos WHERE videoID=?;"; $stmt = mysqli_stmt_init($conn); if (!mysqli_stmt_prepare($stmt, $sql)) { echo'Sql Error'; exit(); } else { mysqli_stmt_bind_param($stmt, "i", $itemid); mysqli_stmt_execute($stmt); $result = mysqli_stmt_get_result($stmt); if (($row = mysqli_fetch_assoc($result)) && !preg_match("/[a-zA-Z]/", $itemid)) { ?> <div class="img" style="background-image: url('<?php echo $row['link']; ?>');"></div> <center><h1>Title <?php echo $row['Title']; ?> exists</h1></center> <?php exit(); } else { ?> <center><h1>Title does not exist</h1></center> <?php exit(); } }}正如你所看到的兩個 Isset if 非常相似，我想知道是否有一個解決方案將兩者結合起來，這樣我就不必兩次編寫相同的結果，如果有人想提供有關 sql 注入安全性的反饋我的代碼將受到歡迎！這也是我在這里提出的第一個問題，所以如果您需要我詳細說明某些內容，請告訴我。
2 回答
千巷貓影
TA貢獻1829條經驗 獲得超7個贊
您可以通過在語句||中使用運算符來實現if，如下所示，并使用三元運算符來獲取用戶是通過鏈接還是通過單擊訪問項目：
<?php
// If user access item through link
if(isset($_POST["v"]) || isset($_POST["itemid"])) {
require "connect.php";
//user ternary operator to check whether user accessed the item through link or click
$var = isset($_POST['v'])?$_POST['v']:$_POST['itemid'];
$sql = "SELECT * FROM videos WHERE videoID=?;";
$stmt = mysqli_stmt_init($conn);
if (!mysqli_stmt_prepare($stmt, $sql)) {
echo'Sql Error';
exit();
}
else {
mysqli_stmt_bind_param($stmt, "i", $var);
mysqli_stmt_execute($stmt);
$result = mysqli_stmt_get_result($stmt);
if (($row = mysqli_fetch_assoc($result)) && !preg_match("/[a-zA-Z]/", $var)) { ?>
<div class="img" style="background-image: url('<?php echo $row['link']; ?>');"></div>
<center><h1>Title <?php echo $row['Title']; ?> exists</h1></center>
<?php exit();
}
else { ?>
<center><h1>Title does not exist</h1></center>
<?php exit();
}
}
}
?>
阿波羅的戰車
TA貢獻1862條經驗 獲得超6個贊
是的，除了 POST 參數之外，兩者似乎都很相似，為什么不使用一個可以處理兩個 isset 條件的函數呢！
有點像這樣，
function funcName($param){
require "connect.php";
//$v = $_POST['v'];
$sql = "SELECT * FROM videos WHERE videoID=?;";
$stmt = mysqli_stmt_init($conn);
if (!mysqli_stmt_prepare($stmt, $sql)) {
echo'Sql Error';
exit();
}
else {
mysqli_stmt_bind_param($stmt, "i", $param);
mysqli_stmt_execute($stmt);
$result = mysqli_stmt_get_result($stmt);
if (($row = mysqli_fetch_assoc($result)) && !preg_match("/[a-zA-Z]/", $v)) { ?>
<div class="img" style="background-image: url('<?php echo $row['link']; ?>');"></div>
<center><h1>Title <?php echo $row['Title']; ?> exists</h1></center>
<?php exit();
}
else { ?>
<center><h1>Title does not exist</h1></center>
<?php exit();
}
}
}
然后，
if(isset($_POST["v"])) {
$param = $_POST["v"];
funcName($param);
}
if(isset($_POST["itemid"])) {
$param = $_POST["itemid"];
funcName($param);
}
- 2 回答
- 0 關注
- 134 瀏覽
添加回答
舉報
0/150
提交
取消